15 ms·

Unfortunately this caching is still per-path. For example: GET /v1/document/{document-id}/comments/{comment-id} For every new document-id or comment-id, t

Unfortunately this caching is still per-path. For example: GET /v1/document/{document-id}/comments/{comment-id} For every new document-id or comment-id, there will be a new pre-flight request. Alternative hacks: Offer a variant of your API format that either 1. Moves the resource path to the request body (or to a header that is included in "Vary"). Though the rest of your stack (load balancing, observability, redaction) might not be ok with this, e.g. do your WAF rules support matching on the request body? You also will no longer get automatic path-based caching for GET requests. 2. Conforms to the rules of a CORS "simple" request [1], which won't trigger a pre-flight request. This is what we did on the Dropbox API [2]. You'll need to move the auth information from the Authorization header to a query parameter or the body, which can be dangerous wrt redaction, e.g. many tools automatically redact the Authorization header but not query parameters. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl... [2] https://www.dropbox.com/developers/documentation/http/documentation https://www.dropbox.com/developers/documentation/http/docume... (see "Browser-based JavaScript and CORS pre-flight requests")

enlyth 4y ago
> Offer a variant of your API format that either: 1. Moves the resource path to the request body GraphQL ducks
- danwee 4y ago
  > GraphQL And now you have two problems
  - pas 4y ago
    But you have a nice schema for your problem :) GQL is a bit ugly, but works well, kind of standardized, etc. Is there something similar for providing a batch endpoint for OpenAPI requests?
    - marcofatica 4y ago
      GET /blog/1?with=comments,author&only=title,body,created_at,comments.body,author.name
  - enlyth 4y ago
    I got N+1 problems but CORS ain't one
Cthulhu_ 4y ago
3. Don't allow cross-platform requests in the first place; have your API consumers go through a server-side proxy on the same domain instead, or host it on the same domain in the first place.
- zmxz 4y ago
  This is the only valid solution and the easiest one to implement. However, for some reason unknown to me - younger devs and various organizations simply refuse to go down this route and make up reasons why it doesn't work for them, opting for more time-consuming alternatives.
  - LunaSea 4y ago
    If you serve your static files from a CDN it's simply not possible to do so. It's a very common case.
    - tylerhou 4y ago
      IIRC Cloudflare has page rules, which makes this possible? In fact, with page rules, Cloudflare can proxy a subpath (like /api) to a completely different domain.
      - LunaSea 4y ago
        As I mentioned above this doesn't work for all CDNs and also involves trusting your CDN to MitM your API
        zmxz 4y ago
        This kind of comment falls under what I posted originally - people making up reasons why they can't go with proxy solution.
        LunaSea 4y ago
        I don't think that security requirements are a "made up" restriction. It's like saying that a house built without a lock is a made up issue and that no lock pr door is needed.
nmjenkins 4y ago
> Moves the resource path to the request body JMAP is very well suited to CORS due to this: https://www.rfc-editor.org/rfc/rfc8620.html https://www.rfc-editor.org/rfc/rfc8620.html
three14 4y ago
To hijack the thread a bit, if you are still with Dropbox, could you get them to implement what you did in #2 in the official Dropbox JS SDK? Right now it still does a pre-flight request for everything.
- cakoose 4y ago
  No, I left Dropbox 5 years ago. But it might be easy to add? https://github.com/dropbox/dropbox-sdk-js/blob/main/src/dropbox.js https://github.com/dropbox/dropbox-sdk-js/blob/main/src/drop... Make sure to always set the URL parameter "reject_cors_preflight=true", which will make sure you're not inadvertently triggering pre-flight requests.
giancarlostoro 4y ago
> Conforms to the rules of a CORS "simple" request [1], which won't trigger a pre-flight request. I was about to ask if OPTIONS would be sufficient, but it looks like some of the MDN URLs suggest just that.
yencabulator 4y ago
Yeah. For example, the Meilisearch search engine recommends submitting idempotent searches over POST and not GET due to this: https://docs.meilisearch.com/reference/api/search.html https://docs.meilisearch.com/reference/api/search.html I wish they'd standardize HTTP QUERY soon: https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-method-w-body/ https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-met...

enlyth 4y ago

> Offer a variant of your API format that either: 1. Moves the resource path to the request body GraphQL ducks

danwee 4y ago
> GraphQL And now you have two problems
- pas 4y ago
  But you have a nice schema for your problem :) GQL is a bit ugly, but works well, kind of standardized, etc. Is there something similar for providing a batch endpoint for OpenAPI requests?
  - marcofatica 4y ago
    GET /blog/1?with=comments,author&only=title,body,created_at,comments.body,author.name
- enlyth 4y ago
  I got N+1 problems but CORS ain't one

Cthulhu_ 4y ago

3. Don't allow cross-platform requests in the first place; have your API consumers go through a server-side proxy on the same domain instead, or host it on the same domain in the first place.

zmxz 4y ago
This is the only valid solution and the easiest one to implement. However, for some reason unknown to me - younger devs and various organizations simply refuse to go down this route and make up reasons why it doesn't work for them, opting for more time-consuming alternatives.
- LunaSea 4y ago
  If you serve your static files from a CDN it's simply not possible to do so. It's a very common case.
  - tylerhou 4y ago
    IIRC Cloudflare has page rules, which makes this possible? In fact, with page rules, Cloudflare can proxy a subpath (like /api) to a completely different domain.
    - LunaSea 4y ago
      As I mentioned above this doesn't work for all CDNs and also involves trusting your CDN to MitM your API
      - zmxz 4y ago
        This kind of comment falls under what I posted originally - people making up reasons why they can't go with proxy solution.
        LunaSea 4y ago
        I don't think that security requirements are a "made up" restriction. It's like saying that a house built without a lock is a made up issue and that no lock pr door is needed.

nmjenkins 4y ago

> Moves the resource path to the request body JMAP is very well suited to CORS due to this: https://www.rfc-editor.org/rfc/rfc8620.html https://www.rfc-editor.org/rfc/rfc8620.html

three14 4y ago

To hijack the thread a bit, if you are still with Dropbox, could you get them to implement what you did in #2 in the official Dropbox JS SDK? Right now it still does a pre-flight request for everything.

cakoose 4y ago
No, I left Dropbox 5 years ago. But it might be easy to add? https://github.com/dropbox/dropbox-sdk-js/blob/main/src/dropbox.js https://github.com/dropbox/dropbox-sdk-js/blob/main/src/drop... Make sure to always set the URL parameter "reject_cors_preflight=true", which will make sure you're not inadvertently triggering pre-flight requests.

giancarlostoro 4y ago

> Conforms to the rules of a CORS "simple" request [1], which won't trigger a pre-flight request. I was about to ask if OPTIONS would be sufficient, but it looks like some of the MDN URLs suggest just that.

yencabulator 4y ago

Yeah. For example, the Meilisearch search engine recommends submitting idempotent searches over POST and not GET due to this: https://docs.meilisearch.com/reference/api/search.html https://docs.meilisearch.com/reference/api/search.html I wish they'd standardize HTTP QUERY soon: https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-method-w-body/ https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-met...